Attributes of the records MFT. Catalogues in NTFS.

Master File Table

In NTFS, all file, directory and metafile data —file name, creation date, access permissions (by the use of access control lists), and size— are stored as metadata in the Master File Table. This abstract approach allowed easy addition of file system features during Windows NT's development—an interesting example is the addition of fields for indexing used by the Active Directorysoftware. This also enables software like Everything or Ultrasearch to perform instantaneous real-time searches for file and folder names, without relying on an indexing service.

The MFT structure supports algorithms which minimize disk fragmentation. A directory entry consists of a filename and a "file ID", which is the record number representing the file in the Master File Table. The file ID also contains a reuse count to detect stale references. While this strongly resembles the W_FID of Files-11, other NTFS structures radically differ.

The MFT (Master File Table) is the vital core of the NTFS structure. All data

stored on a volume is contained in the MFT. By storing all of this information

within a file, NTFS can easily locate and maintain the data, and a security

descriptor, used by NT’s security model, can protect each separate file. The MFT

is essentially an array of records with each record holding data about a particular

file in the volume. In addition, it also includes a file record for itself so that the

MFT can be rebuilt in case it becomes damaged. The MFT also includes file records for the NTFS metadata files that help implement the file system

structure—i.e. data structures used to locate and retrieve files, the bootstrap

data, and the bitmap that records the allocation state of the entire volume. Each

of these NTFS metadata files has a name beginning with a dollar sign ($) to

differentiate them from other system files and user files:

· $MFT – the Master File Table

· $MFTMirr – contains a copy of the first few rows of the MFT, used to locate

metadata files in case the MFT file is corrupt for some reason

· $LogFile – used to record all disk operations that affect the NTFS volume

structure such as file creations, file copying, file deletion, etc. After a system

failure, NTFS uses the log file to recover the NTFS volume.

· $Bitmap – records the allocation state of the NTFS volume. Each bit in the

bitmap represents a cluster on the volume, identifying whether the cluster is

free or has been allocated to a file.

· $Boot – stores the Windows NT bootstrap code.

· $BadClus – records any bad clusters on the volume so that Windows NT will

not write to that disk region in the future.

· $Volume – records the NT volume name, version of NTFS on which the

volume was written, and a bit that signifies whether or not a disk corruption

has occurred.

· $AttrDef – attribute definition table – defines attribute types supported on the

volume and indicates whether they can be indexed, recovered during a

system recovery operation, etc.

Date: 2015-01-29; view: 1041